Hi @Wohamed_wakkad , this is a recognized by Splunk Professional Services architecture, so you can open a ticket to Splunk Support. Ciao. Giuseppe ... View more

Hi @hotrodbass , you need to add the time factor and the threshold to your search, something like this: index=linux | rex field=_raw "(?<pctUser>[0-9]+(?:\.[0-9]+)?)\s+(?<pctNice>[0-9]+(?:\.[0-9]+)?)\s+(?<pctSystem>[0-9]+(?:\.[0-9]+)?)\s+(?<pctIowait>[0-9]+(?:\.[0-9]+)?)\s+(?<pctIdle>[0-9]+(?:\.[0-9]+)?)" | eval cpu_busy_pct=round(pctUser + pctNice + pctSystem, 2) | eval cpu_non_idle_pct=round(100 - pctIdle, 2) | bin span=5m _time | fields _time host pctUser pctNice pctSystem pctIowait pctIdle cpu_busy_pct cpu_non_idle_pct | stats max(*) AS * BY _time | where cpu_busy_pct>=90 Ciao. Giuseppe ... View more

Hi @USA69 , good for you, see next time! let us know if we can help you more, or, please, accept one answer for the other people of Community. Ciao and happy splunking Giuseppe P.S.: Karma Points are appreciated by all the contributors 😉 ... View more

Hi @USA69 , I cannot test the search, so, see my approach and apply it to your search: index="maj_p" OnboardingStatus=Onboarded OSPlatform=windows1* | stats latest(OnboardingStatus) AS OnboardingStatus latest(SensorHealthState) AS SensorHealthState latest(OSPlatform) AS OSPlatform latest(ClientVersion) AS ClientVersion latest(_time) AS Def_Lastseen BY DeviceName | eval Week_breakdown=case(Def_Lastseen>=relative_time(now(), "-7d@d"), "1-7 days", Def_Lastseen>=relative_time(now(), "-15d@d") AND Def_Lastseen<relative_time(now(), "-7d"), "8-15 days") | eval nt_host=upper(replace(DeviceName, "\..*$", "")) | append [ | inputlookup workstation* WHERE hostname!="*.corp" (dv_install_status IN ("In use", "In stock") OR ds="dal" OR (seen_by_obt="n/a" AND ds!="dal")) AND (seen_by_cs="Yes" OR seen_by_q="Yes" OR seen_by_sccm_status="Yes") AND (os="Windows" OR os="WINDOWS") | eventstats count as scope_count ] | stats values(*) AS * BY nt_host | eval nt_host=upper(replace(DeviceName, "\..*$", ""))] | search OnboardingStatus=* | stats count as agent_count by scope_count | eval missing_agents = scope_count - agent_count | eval incompleteness = round((missing_agents/scope_count) * 100, 2) | eval completeness = round((agent_count/scope_count) * 100, 2)" Ciao. Giuseppe ... View more

Hi @USA69 , there is a main issue in your search: putting the search on index in the subsearch, you have the limit of 50,000 results for the subsearch, for this reason it's a best practice to put the index search in the main search and use the inpulookup search in the subsearch or (better) use the lookup command. In addition the join command is a commad to avoid because it's very slow and resource cosuming. I will try to rewrite your search later. Ciao. Giuseppe ... View more

Hi @bowesmana , yes correct! I always forgot it and I have to replace the command! Ciao. Giuseppe ... View more

Hi @ChrisHms , they should be in the dispatch folder, but anyway you cannot access and recognize them. Why do you want to access them? Ciao. Giuseppe ... View more

Hi @LizAndy123 , it's really difficoult to help you without having a view on the fields that you want to compare, anyway, I'll try to give you a generic answer. If ProjectID is the correlation field and Data_Security_Details is the field to check, you could run somering line this: index=<your_index> earliest=-2d@d latest=@d | eval day=strftime(_time,"%d"), period=if(day=strftime(now()-86400,"%d"),"last_day","previous_day") | stats values(eval(period="last_day")) AS Data_Security_Details_last_day values(eval(period="previous_day")) AS Data_Security_Details_previous_day BY ProjectID In this way, you can compare values of a field in two different periods. Ciao. Giuseppe ... View more

Hi @BradOH , you can do this pre-processing the CSV before ingestion or at search time using my search. I'm not sure that it's possible to apply the transformation at index time. Ciao. Giuseppe ... View more

Hi @Na_Kang_Lim , Use the "Splunk Add-on for AWS". Ciao. Giuseppe ... View more

Hi @BradOH , where did you insert the transformation to split names: in a search or where? if in search I'd use something like this: <your_search> | rename "Full Name" AS Full_Name | rex field=Full_Name "?<Last_Name>^\S+)\s+(?<First_Name>.+$" Ciao. Giuseppe ... View more

Hi @amirahmed , as @livehybrid pointed on, there isn't any add-on on Splunkbase for  Informatica IDMC, this means that you have to create a custom add-on, that I hint to publish on Splunkbase for the other users. So the first step is to understand which data can you extract from your system for your scopes but at first you should define the perimeter of your job:  do you need only security events or also ITOPS? do you need business insight data? which data do you need to extract for your purpose? I'd like to say: extract all the data, but probably you need only a subset of them. After this first step, you should identify the Splunk Data Models where storing these data and the data structure to extract (fields, values, etc...). At least the way to extract these data. Probably the creation od python scripts that use REST API is the best solution, also using the splunk features to encrypt account credentials. To do this last step, as @livehybrid hinted, you should at first create the scripts and then package them in an add-on using Add-On Builder, in this way you'll have a well packaged add-on with a correct normalization for use in Splunk. Ciao. Giuseppe ... View more

Hi @fedayn05 , we also had apparently sufficient resources, but, viewing the VM-Ware console, how many applications are running on the same physical infrastructure? We had 10 Indexers and 3 Search Heads with 40 CPUs each one, but all of them worked on the same 36 physical CPUs on the VM-Ware infrastructure! Splunk required, for virtual installations, dedicated resources! in addition, how many scheduled searches you are running? how many of them are in real-time mode? 38 CPUs are many in general but maybe are not enough for your requirements. The behaviour you described id usually in case of not enough resources. Ciao. Giuseppe ... View more

Hi @lok_g , You can see in the Enterprise Security Audit Data Model dashboard and in the Monitoring Console if there's a fail in the Data model Execution, so youcan take this search and transform it in an alert. Ciao. Giuseppe ... View more

Hi @kjain041523 , if you use a Data Model, you don't have raw data, so you have to divide the output in two panel with two searches (one using DM for statistics and one using indexes for raw data, eventually filtering results from the first panel) or use indexes. Using indexes in one search, you could try something like this: (`cim_Intrusion_Detection_indexes`) tag=ids tag=attack | stats count dc(IDS_Attacks.dest) as dest values(_raw) AS _raw by src signature _time | `drop_dm_object_name("IDS_Attacks")` | search NOT signature=Unknown* signature="Vulnerability exploit detection(32796)" Ciao. Giuseppe P.S.: WHERE * has no sense! ... View more

Hi @fedayn05 , I frequently encountered this issue in an insufficient resources architecture: the Indexers were installed on a VM-Ware cluster but resources weren't dedicated and I had around 400 virtual cpus working on 48 physical cpus. So there were situations in which the physical infrastructure wasn't in condition to support the requests. Check the vm-ware status report and the resources that you are dedicating to Splunk, remembering that Splunk requires, on a virtual infrastructure, to have dedicated resources and a plus of around 30% if resources are virtual. Ciao. Giuseppe ... View more

Hi @varunkulkarni16 , I encountered this issue several times, every one for a different reason: Once the issue was the version: we migrated (in different steps) from 7 to 10 and we had to stop the upgrade to 9, which is your version? another time, the issue was that the DS was installed on the same machine with Cluster Manager and Deployer (on different instances) and resources weren't sufficient, what is the configuration of your server? another time the issu was the presence of another DS in the network, is this your situation? Ciao. Giuseppe  ... View more

Hi, You could try something like this: index=sacs sourcetype IN (SACS_Behaviour_Events, SACS_TemaKey_Events) | streamstats count BY sourcetype | stats values(count) AS "SI.No" values(PointName) AS "Door Name" values(BehaviorId) AS "Access Level ID" values(BehaviorModel) AS "Access Level Name" values(ServerLocation) AS "Site" BY sourcetype | fields - sourcetype even if, as I said, you will have empty cells in your table. Ciao. Giuseppe ... View more

Hi @priyankavj , you can create one table with both the data, but obviously you will have many empty cells in your table. Anyway, you can do something like this: index=<your_index> sourcetype IN (sourcetypeA, sourcetypeB ) | table _time sourcetype user_id user_role device_id device_type or index=<your_index> sourcetype IN (sourcetypeA, sourcetypeB ) | stats values(user_id) AS user_id values(user_role) AS user_role values(device_id) AS device_id values(device_type) AS device_type By _time sourcetype you could also avoid to have empty cells but I'm nor sure that this solution has a sense: index=<your_index> sourcetype IN (sourcetypeA, sourcetypeB ) | eval user_id_device_id=coalesce(user_id,device_id) user_role_device_type=coalesce(user_role,device_type) | stats values(user_id_device_id) AS user_id_device_id values(user_role_device_type) AS user_role_device_type By _time sourcetype Ciao. Giuseppe ... View more

Hi @nebilcy , Immediately after passing the Cyber ​​Defense Analyst final exam, you should have received an email from Credly notifying you that your badge has been issued. If this hasn't happened, I recommend connecting to the Credly website ( www.credly.com ) with your credentials and verifying. Ciao. Giuseppe ... View more

Hi @Praz_123 , in addition I don't find the add-on the you used in splunkbase, which one did you used? a custom one? probably the sourcetype is assigned is in the add-on. Ciao. Giuseppe ... View more

Hi @Praz_123 , the @richgalloway 's answer should answer to your question. In addition I could say also that, if you need to upgrade many clients and you have a Deployment Server, you could use the "TA - Splunk UF Upgrade Automation for Windows" ( https://splunkbase.splunk.com/app/8802 ), but only from the next upgrade because it runs from the 9.0 version. Ciao. Giuseppe ... View more